Cyber Resilience

CWE · MITRE source

CWE-611Improper Restriction of XML External Entity Reference

Abstraction: Base · CVEs in our corpus: 1,294

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): CAPEC 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A02:2025 Security Misconfiguration.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • CA-8 Penetration Testing
  • SI-4 System Monitoring
  • PR.PS-01
  • PR.PS-06
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.5.1
  • V15.3.2

NIST 800-53 r5 controls that address this weakness (2)AI-assisted

Control Title Family Why it addresses this CWE
CA-8Penetration TestingCAPenetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.
SI-4System MonitoringSIIdentifies XML external entity processing via monitoring of unusual file/network access or resource usage.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2017-12629 9.99.80.91902017-10-14
CVE-2019-9670 KEV 9.99.80.99992019-05-29
CVE-2022-28219 9.99.80.97192022-04-05
CVE-2024-34102 KEV 9.99.80.99992024-06-13
CVE-2021-37425 9.39.10.66282021-08-10
CVE-2025-2775 KEV 9.39.30.42682025-05-07
CVE-2025-2776 KEV 9.39.30.64402025-05-07
CVE-2025-2777 9.29.30.72202025-05-07
CVE-2025-30220 9.29.90.56722025-06-10
CVE-2019-7442 9.19.80.40012019-05-08
CVE-2012-3363 8.99.10.50252013-02-13
CVE-2018-13415 8.99.80.31812018-08-13
CVE-2025-58360 KEV 8.98.20.64872025-11-25
CVE-2025-66516 8.98.40.78792025-12-04
CVE-2018-15531 8.89.80.27872018-09-26
CVE-2023-44412 8.88.20.83682024-05-03
CVE-2025-54254 8.88.60.77132025-08-05
CVE-2016-4264 8.78.60.69042016-09-01
CVE-2018-13417 8.69.80.20692018-08-13
CVE-2018-8420 8.68.80.48902018-09-13
CVE-2024-22024 8.68.30.94722024-02-13
CVE-2018-13416 8.59.80.20192018-08-03
CVE-2019-13608 KEV 8.57.50.30042019-08-29
CVE-2018-1285 8.59.80.17372020-05-11
CVE-2023-45727 KEV 8.57.50.03542023-10-18